Book a demo

TANGRAM TENON

Build software that integrates.

Tenon is a command-line tool suite that helps engineers design software interfaces in Flex, prove the design, test component binaries against it, and trace every result to a requirement.

Write my design in Flex and see what's in it

Prove my design with formal methods

Test my component binary against the design

Show which requirements have evidence behind them

~/mission-system
$ tenon flex elements spec
global_protocol HandOver
component MissionPlanner
component VehicleBridge
component PayloadController
global_protocol SubmitMission
global_protocol StreamTelemetry
global_protocol CommandPayload
$
$ tenon verify model spec
4 protocols checked · 4 Proven
$
$ tenon verify component components/PayloadController \
--flex ../../spec
✔ PayloadControllerFlow: passed
tenon: CONFORMANT — all protocols valid
$
$ tenon verify requirements spec \
--modelcheck out/modelcheck.json \
--verifier out/verifier_good/results.json
3 supported, 0 contradicted, 0 unknown, 1 unclaimed
$

Four steps from interface design to verified software.

From the first interface sketch to the design review. Every step runs on a laptop and in CI.

01 · DEFINE

Capture your system in a checkable design.

Describe your system in Flex, drawing on your ICDs, requirements, models and code. Tenon checks it and draws the diagrams.

From your sources to a design Tenon can check ICDs, requirements, Cameo models and codebases are hard to test. Captured in Flex, the design is precise and checkable. Tenon checks it for errors and draws diagrams for review. ICDs Requirements Cameo models Codebases Hard to test A B One Flex design No errors Checked + diagrams From your sources to a design Tenon can check ICDs, requirements, Cameo models and codebases are hard to test. Captured in Flex, the design is precise and checkable. Tenon checks it for errors and draws diagrams for review. ICDs Requirements Cameo models Codebases Hard to test A B Flex design Checked + diagrams

02 · CHECK

Find the design flaw before anyone builds to it.

Tenon uses formal methods to check every possible message ordering in each protocol, and finds structural flaws like deadlocks before anyone writes code.

HandOver, the deadlock and the fix Before: MissionPlanner waits to receive ControlGrant and VehicleBridge waits to receive ControlRelease, so neither sends and the check reports Indeterminate. After: VehicleBridge sends ControlGrant, then MissionPlanner sends ControlRelease, and the check reports Proven. MissionPlanner VehicleBridge recv ControlGrant recv ControlRelease Deadlock: both sides wait ControlGrant ControlRelease Fixed: one side sends first Indeterminate Proven HandOver, the deadlock and the fix Before: MissionPlanner waits to receive ControlGrant and VehicleBridge waits to receive ControlRelease, so neither sends and the check reports Indeterminate. After: VehicleBridge sends ControlGrant, then MissionPlanner sends ControlRelease, and the check reports Proven. MissionPlanner VehicleBridge recv ControlGrant recv ControlRelease Deadlock: both sides wait ControlGrant ControlRelease Fixed: one side sends first Indeterminate Proven

03 · TEST

Test the component binary against the design.

Tenon generates tests from your design and runs them against the compiled binary, yours or a vendor's, with no source code.

Testing the PayloadController binary against the design Tenon plays MissionPlanner and sends PayloadCommand with id 42 to the compiled PayloadController. The vendor's build replies PayloadAck with id 43, which breaks the design's rule ack.id == cmd.id, and the test fails. The corrected build replies with id 42 and the test passes. PLAYED BY TENON MissionPlanner YOUR BINARY PayloadController Command · id 42 Reply · id 43 Wrong id: should be 42 Reply · id 42 Correct id Failed Passed Testing the PayloadController binary against the design Tenon plays MissionPlanner and sends PayloadCommand with id 42 to the compiled PayloadController. The vendor's build replies PayloadAck with id 43, which breaks the design's rule ack.id == cmd.id, and the test fails. The corrected build replies with id 42 and the test passes. PLAYED BY TENON MissionPlanner YOUR BINARY PayloadController Command · id 42 Reply · id 43 Wrong id: should be 42 Reply · id 42 Correct id Failed Passed

04 · TRACE

Trace results to requirements, fast.

Every result maps back to a requirement, so you can see which requirements are supported, which are contradicted, and which haven't been checked yet.

Evidence from Tenon feeding requirements Design proofs from the check step and component test results from the test step feed into the requirements they support, and one requirement is supported by both. Three of four requirements have evidence; one has none yet. EVIDENCE REQUIREMENTS Design proofs Component tests REQ-1supported REQ-2supported REQ-3 supported REQ-4no evidence yet Evidence from Tenon feeding requirements Design proofs from the check step and component test results from the test step feed into the requirements they support, and one requirement is supported by both. Three of four requirements have evidence; one has none yet. EVIDENCE REQUIREMENTS Design proofs Component tests REQ-1supported REQ-2supported REQ-3 supported REQ-4no evidence yet

Years of assured integration, built in.

Tenon packages the method Tangram's engineers have refined on real defense programs.

  • Integration Design Assurance
  • Assured GRA compliance
  • Open Architecture Transition
  • Government-owned SDK development
  • DevSecOps and secure development pipelines
  • Integration Rapid Response

Built for engineers. Ready for AI agents.

Tenon makes AI development defensible.

AI agent aloneAI agent + Tenon
Design the interfacesDrafts a spec you have to review line by lineDrafts Flex from Tenon's built-in docs, and Tenon flags errors right away
Check the designReasons about deadlocks and ordering by inference, and needs re-checkingFormal methods check every protocol: same model, same verdict
Verify the codeWrites its own tests; keeping them independent takes careful context isolationRuns tests generated from the design your engineers approved
Roll up resultsResults get assembled into evidence by handJSON, exit codes, GitLab test reports and one HTML dashboard, tied to requirements

Built in the way agents expect

~/mission-system
$ tenon verify model spec --format json; echo $?
{
"protocols": [
{
"name": "HandOver",
"verdict": "indeterminate",
"codes": [
{
"code": "not-compatible",
"reason": "the components can reach a state where they disagree"
}
]
},
{ "name": "SubmitMission", "verdict": "proven" },
{ "name": "StreamTelemetry", "verdict": "proven" },
{ "name": "CommandPayload", "verdict": "proven" }
]
}
2
# exit code 2: the design isn't proven, so the agent stops
$

Questions engineers ask

How is a Flex spec created from my ICD and source docs?
Start with the one interface that keeps breaking. Engineers write it from the ICD, and Tenon checks every spec for errors as they go. Tenon also pairs well with an AI agent: hand it your ICD and source docs, and it can draft the Flex, check it with Tenon and fix its own mistakes, so your engineers review a spec that already passes. New to Flex? See flexlang.org.
Does it work with our CI?
Yes. Save your steps as one named workflow and run it with a single command on your laptop. Tenon turns that same workflow into a GitLab pipeline, with no Docker-in-Docker and no privileged containers. Results show up in GitLab's test report and on merge requests, and Tenon rolls everything up into one HTML dashboard. Using something other than GitLab? Ask us.
What do I need to run it?
Linux (x86_64), macOS (Apple Silicon), or Windows through WSL2. You'll also need Docker installed.
Which transports?
TCP, UDP, ZeroMQ, Kafka, ActiveMQ, NATS and RabbitMQ today. Others aren't supported yet. Tell us what you need.
Which message formats?
Direct binary, JSON, Protocol Buffers, XML (including OMS) and MAVLink, with program-specific formats on request.
How is it licensed?
Shared seats on your license, for people and CI jobs alike, through a license server that can run on your own network. Working air-gapped? Ask us.

Let us show you what Tenon can do.

We'll walk you through the tool suite and help you understand how it fits into your integration work.

Book a demo
Download the Tenon one-sheet (PDF)